How can I find the firewall program blocking access to SMB share
I have a very strange issue. Lately (less than 1-2 weeks at max), I cannot access my SMB share anymore from VLC on my Android phone.
I checked this behaviour with "FE File Explorer" on my iPad and it's the same.
So I tried to connect with the FE program and got the following sequence of entries within my Wireshark:
src:~.79, dest: ~.50 | 51089 -> 445 [SYN]
src:~.50, dest: ~.79 | 445 -> 51089 [SYN, ACK]
src:~.79, dest: ~.50 | 51089 -> 445 [ACK]
src:~.79, dest: ~.50 | 51089 -> 445 [FIN, ACK]
src:~.50, dest: ~.79 | 445 -> 51089 [ACK]
src:~.50, dest: ~.79 | 445 -> 51089 [RST, ACK]
From what I can understand after looking into this is that the last line means the connection has been reset. Which makes me think immediately about a firewall program.
However, I haven't changed any settings for Windows Firewall (it's off for the home network), and I did not install -knowingly- any firewall programs.
Is my assumption right? Is the last line an indication of a firewall? Or is it the networking service disconnecting the connection itself? And how can I figure out which program is interfering with the connection?
Thanks!
EDIT1:
When trying to access the SMB share from another computer, I do get this additional information:
After the 3rd ACK, I get:
SMB2 Negotiate Protocol Request
SMB2 Negotiate Protocol Response
SMB2 Session Setup Request, NTLMSSP_NEGOTIATE
SMB2 Session Setup Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE
SMB2 Session Setup Request, NTLMSSP_AUTH: User: other-pcsteven
SMB2 Session Setup Response, Error: STATUS_INVALID_HANDLE
What I glance from this is that it actually connects, and want to make a connection (but with the wrong username because the user is my-pcsteven).
But from my iPad I never got to see these SMB-fields. So there hasn't even been a protocol negotiation?
Did something change in Windows 7 in the past -let's say- month that could lead to this behaviour?
windows-7 networking firewall
asked Jan 13 at 18:36
Steven Van IngelgemSteven Van Ingelgem
11815
add a comment |
I have a very strange issue. Lately (less than 1-2 weeks at max), I cannot access my SMB share anymore from VLC on my Android phone.
I checked this behaviour with "FE File Explorer" on my iPad and it's the same.
So I tried to connect with the FE program and got the following sequence of entries within my Wireshark:
src:~.79, dest: ~.50 | 51089 -> 445 [SYN]
src:~.50, dest: ~.79 | 445 -> 51089 [SYN, ACK]
src:~.79, dest: ~.50 | 51089 -> 445 [ACK]
src:~.79, dest: ~.50 | 51089 -> 445 [FIN, ACK]
src:~.50, dest: ~.79 | 445 -> 51089 [ACK]
src:~.50, dest: ~.79 | 445 -> 51089 [RST, ACK]
From what I can understand after looking into this is that the last line means the connection has been reset. Which makes me think immediately about a firewall program.
However, I haven't changed any settings for Windows Firewall (it's off for the home network), and I did not install -knowingly- any firewall programs.
Is my assumption right? Is the last line an indication of a firewall? Or is it the networking service disconnecting the connection itself? And how can I figure out which program is interfering with the connection?
Thanks!
EDIT1:
When trying to access the SMB share from another computer, I do get this additional information:
After the 3rd ACK, I get:
SMB2 Negotiate Protocol Request
SMB2 Negotiate Protocol Response
SMB2 Session Setup Request, NTLMSSP_NEGOTIATE
SMB2 Session Setup Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE
SMB2 Session Setup Request, NTLMSSP_AUTH: User: other-pcsteven
SMB2 Session Setup Response, Error: STATUS_INVALID_HANDLE
What I glance from this is that it actually connects, and want to make a connection (but with the wrong username because the user is my-pcsteven).
But from my iPad I never got to see these SMB-fields. So there hasn't even been a protocol negotiation?
Did something change in Windows 7 in the past -let's say- month that could lead to this behaviour?
windows-7 networking firewall
asked Jan 13 at 18:36
Steven Van IngelgemSteven Van Ingelgem
11815
Based on your last edit, have you checked if somehow any update have been installed through automatic update in that time frame?
– Manuel Florian
Jan 13 at 19:45
@ManuelFlorian: KB4480970 (9 jan), KB4480063 (9 jan), KB4483187 (22 dec), KB4480055 (9 jan). Thanks for the hint. I think KB4480970 is causing this issue!
– Steven Van Ingelgem
Jan 14 at 4:48
@ManuelFlorian: uninstalling that one fixed it. Can you post it as an answer so I can accept it? [bleepingcomputer.com/news/microsoft/…
– Steven Van Ingelgem
Jan 14 at 4:56
Ohhh I'm glad it worked. I copied and pasted as an answer so you can accept it.
– Manuel Florian
Jan 14 at 5:04
add a comment |
I have a very strange issue. Lately (less than 1-2 weeks at max), I cannot access my SMB share anymore from VLC on my Android phone.
I checked this behaviour with "FE File Explorer" on my iPad and it's the same.
So I tried to connect with the FE program and got the following sequence of entries within my Wireshark:
src:~.79, dest: ~.50 | 51089 -> 445 [SYN]
src:~.50, dest: ~.79 | 445 -> 51089 [SYN, ACK]
src:~.79, dest: ~.50 | 51089 -> 445 [ACK]
src:~.79, dest: ~.50 | 51089 -> 445 [FIN, ACK]
src:~.50, dest: ~.79 | 445 -> 51089 [ACK]
src:~.50, dest: ~.79 | 445 -> 51089 [RST, ACK]
From what I can understand after looking into this is that the last line means the connection has been reset. Which makes me think immediately about a firewall program.
However, I haven't changed any settings for Windows Firewall (it's off for the home network), and I did not install -knowingly- any firewall programs.
Is my assumption right? Is the last line an indication of a firewall? Or is it the networking service disconnecting the connection itself? And how can I figure out which program is interfering with the connection?
Thanks!
EDIT1:
When trying to access the SMB share from another computer, I do get this additional information:
After the 3rd ACK, I get:
SMB2 Negotiate Protocol Request
SMB2 Negotiate Protocol Response
SMB2 Session Setup Request, NTLMSSP_NEGOTIATE
SMB2 Session Setup Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE
SMB2 Session Setup Request, NTLMSSP_AUTH: User: other-pcsteven
SMB2 Session Setup Response, Error: STATUS_INVALID_HANDLE
What I glance from this is that it actually connects, and want to make a connection (but with the wrong username because the user is my-pcsteven).
But from my iPad I never got to see these SMB-fields. So there hasn't even been a protocol negotiation?
Did something change in Windows 7 in the past -let's say- month that could lead to this behaviour?
windows-7 networking firewall
asked Jan 13 at 18:36
Steven Van IngelgemSteven Van Ingelgem
11815
I have a very strange issue. Lately (less than 1-2 weeks at max), I cannot access my SMB share anymore from VLC on my Android phone.
I checked this behaviour with "FE File Explorer" on my iPad and it's the same.
So I tried to connect with the FE program and got the following sequence of entries within my Wireshark:
src:~.79, dest: ~.50 | 51089 -> 445 [SYN]
src:~.50, dest: ~.79 | 445 -> 51089 [SYN, ACK]
src:~.79, dest: ~.50 | 51089 -> 445 [ACK]
src:~.79, dest: ~.50 | 51089 -> 445 [FIN, ACK]
src:~.50, dest: ~.79 | 445 -> 51089 [ACK]
src:~.50, dest: ~.79 | 445 -> 51089 [RST, ACK]
From what I can understand after looking into this is that the last line means the connection has been reset. Which makes me think immediately about a firewall program.
However, I haven't changed any settings for Windows Firewall (it's off for the home network), and I did not install -knowingly- any firewall programs.
Is my assumption right? Is the last line an indication of a firewall? Or is it the networking service disconnecting the connection itself? And how can I figure out which program is interfering with the connection?
Thanks!
EDIT1:
When trying to access the SMB share from another computer, I do get this additional information:
After the 3rd ACK, I get:
SMB2 Negotiate Protocol Request
SMB2 Negotiate Protocol Response
SMB2 Session Setup Request, NTLMSSP_NEGOTIATE
SMB2 Session Setup Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE
SMB2 Session Setup Request, NTLMSSP_AUTH: User: other-pcsteven
SMB2 Session Setup Response, Error: STATUS_INVALID_HANDLE
What I glance from this is that it actually connects, and want to make a connection (but with the wrong username because the user is my-pcsteven).
But from my iPad I never got to see these SMB-fields. So there hasn't even been a protocol negotiation?
Did something change in Windows 7 in the past -let's say- month that could lead to this behaviour?
windows-7 networking firewall
windows-7 networking firewall
asked Jan 13 at 18:36
Steven Van IngelgemSteven Van Ingelgem
11815
asked Jan 13 at 18:36
Steven Van IngelgemSteven Van Ingelgem
11815
edited Jan 13 at 19:29
Steven Van Ingelgem
asked Jan 13 at 18:36
Steven Van IngelgemSteven Van Ingelgem
11815
asked Jan 13 at 18:36
Steven Van IngelgemSteven Van Ingelgem
11815
asked Jan 13 at 18:36
Steven Van IngelgemSteven Van Ingelgem
11815
11815
Based on your last edit, have you checked if somehow any update have been installed through automatic update in that time frame?
– Manuel Florian
Jan 13 at 19:45
@ManuelFlorian: KB4480970 (9 jan), KB4480063 (9 jan), KB4483187 (22 dec), KB4480055 (9 jan). Thanks for the hint. I think KB4480970 is causing this issue!
– Steven Van Ingelgem
Jan 14 at 4:48
@ManuelFlorian: uninstalling that one fixed it. Can you post it as an answer so I can accept it? [bleepingcomputer.com/news/microsoft/…
– Steven Van Ingelgem
Jan 14 at 4:56
Ohhh I'm glad it worked. I copied and pasted as an answer so you can accept it.
– Manuel Florian
Jan 14 at 5:04
add a comment |
Based on your last edit, have you checked if somehow any update have been installed through automatic update in that time frame?
– Manuel Florian
Jan 13 at 19:45
@ManuelFlorian: KB4480970 (9 jan), KB4480063 (9 jan), KB4483187 (22 dec), KB4480055 (9 jan). Thanks for the hint. I think KB4480970 is causing this issue!
– Steven Van Ingelgem
Jan 14 at 4:48
@ManuelFlorian: uninstalling that one fixed it. Can you post it as an answer so I can accept it? [bleepingcomputer.com/news/microsoft/…
– Steven Van Ingelgem
Jan 14 at 4:56
Ohhh I'm glad it worked. I copied and pasted as an answer so you can accept it.
– Manuel Florian
Jan 14 at 5:04
Based on your last edit, have you checked if somehow any update have been installed through automatic update in that time frame?
– Manuel Florian
Jan 13 at 19:45
Based on your last edit, have you checked if somehow any update have been installed through automatic update in that time frame?
– Manuel Florian
Jan 13 at 19:45
@ManuelFlorian: KB4480970 (9 jan), KB4480063 (9 jan), KB4483187 (22 dec), KB4480055 (9 jan). Thanks for the hint. I think KB4480970 is causing this issue!
– Steven Van Ingelgem
Jan 14 at 4:48
@ManuelFlorian: KB4480970 (9 jan), KB4480063 (9 jan), KB4483187 (22 dec), KB4480055 (9 jan). Thanks for the hint. I think KB4480970 is causing this issue!
– Steven Van Ingelgem
Jan 14 at 4:48
@ManuelFlorian: uninstalling that one fixed it. Can you post it as an answer so I can accept it? [bleepingcomputer.com/news/microsoft/…
– Steven Van Ingelgem
Jan 14 at 4:56
@ManuelFlorian: uninstalling that one fixed it. Can you post it as an answer so I can accept it? [bleepingcomputer.com/news/microsoft/…
– Steven Van Ingelgem
Jan 14 at 4:56
Ohhh I'm glad it worked. I copied and pasted as an answer so you can accept it.
– Manuel Florian
Jan 14 at 5:04
Ohhh I'm glad it worked. I copied and pasted as an answer so you can accept it.
– Manuel Florian
Jan 14 at 5:04
add a comment |
1 Answer
1
active
oldest
votes
Based on your last edit, have you checked if somehow any update have been installed through automatic update in that time frame?
answered Jan 14 at 5:06
Manuel FlorianManuel Florian
1595
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1393853%2fhow-can-i-find-the-firewall-program-blocking-access-to-smb-share%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Based on your last edit, have you checked if somehow any update have been installed through automatic update in that time frame?
answered Jan 14 at 5:06
Manuel FlorianManuel Florian
1595
add a comment |
Based on your last edit, have you checked if somehow any update have been installed through automatic update in that time frame?
answered Jan 14 at 5:06
Manuel FlorianManuel Florian
1595
add a comment |
Based on your last edit, have you checked if somehow any update have been installed through automatic update in that time frame?
answered Jan 14 at 5:06
Manuel FlorianManuel Florian
1595
Based on your last edit, have you checked if somehow any update have been installed through automatic update in that time frame?
answered Jan 14 at 5:06
Manuel FlorianManuel Florian
1595
answered Jan 14 at 5:06
Manuel FlorianManuel Florian
1595
answered Jan 14 at 5:06
Manuel FlorianManuel Florian
1595
answered Jan 14 at 5:06
Manuel FlorianManuel Florian
1595
1595
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1393853%2fhow-can-i-find-the-firewall-program-blocking-access-to-smb-share%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Based on your last edit, have you checked if somehow any update have been installed through automatic update in that time frame?
– Manuel Florian
Jan 13 at 19:45
@ManuelFlorian: KB4480970 (9 jan), KB4480063 (9 jan), KB4483187 (22 dec), KB4480055 (9 jan). Thanks for the hint. I think KB4480970 is causing this issue!
– Steven Van Ingelgem
Jan 14 at 4:48
@ManuelFlorian: uninstalling that one fixed it. Can you post it as an answer so I can accept it? [bleepingcomputer.com/news/microsoft/…
– Steven Van Ingelgem
Jan 14 at 4:56
Ohhh I'm glad it worked. I copied and pasted as an answer so you can accept it.
– Manuel Florian
Jan 14 at 5:04